RCLAMP File::Find::Rule up to 0.34 on Perl grep os command injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in RCLAMP File::Find::Rule up to 0.34 on Perl. This issue affects the function grep. The manipulation leads to os command injection. This vulnerability is traded as CVE-2011-10007. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in RCLAMP File::Find::Rule up to 0.34 on Perl. This issue affects the function grep. The manipulation with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encounters a crafted filename. A file handle is opened with the 2 argument form of `open()` allowing an attacker controlled filename to provide the MODE parameter to `open()`, turning the filename into a command to be executed. Example: $ mkdir /tmp/poc; echo > "/tmp/poc/|id" $ perl -MFile::Find::Rule \     -E 'File::Find::Rule->grep("foo")->in("/tmp/poc")' uid=1000(user) gid=1000(user) groups=1000(user),100(users)

The advisory is shared at metacpan.org. The identification of this vulnerability is CVE-2011-10007 since 06/05/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. MITRE ATT&CK project uses the attack technique T1202 for this issue.

The exploit is available at rt.cpan.org. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 237807 (Debian dsa-5936 : libfile-find-rule-perl - security update), which helps to determine the existence of the flaw in a target environment.

Applying the patch df58128bcee4c1da78c34d7f3fe1357e575ad56f is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (237807) and EUVD (EUVD-2011-5236). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• RCLAMP

Name

• File::Find::Rule

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion